The Cyber BLU Project: Social engineering (security) - Wikipedia, the free encyclopedia

Social engineering (security)From Wikipedia, the free encyclopedia•
Ten things you may not know about images on Wikipedia •Jump to: navigation, searchThis article is about the manipulation of individuals. For social engineering in terms of influencing popular behavior, see Social engineering (political science).

Social engineering is a collection of techniques used to manipulate people into performing actions or divulging confidential information.

[1] While similar to a confidence trick or simple fraud, the term typically applies to trickery for information gathering or computer system access and in most cases the attacker never comes face-to-face with the victim.Contents[hide] * 1 Social engineering techniques and terms o 1.1 Pretexting o 1.2 Phishing + 1.2.1 IVR/phone phishing o 1.3 Trojan horse/gimmes + 1.3.1 Road apple o 1.4 Quid pro quo *

2 Notable social engineers o 2.1 Kevin Mitnick o 2.2 Others *

3 United States law o 3.1 Pretexting of phone records o 3.2 The Gramm-Leach-Bliley Act (GLBA) *

4 Social engineering in popular culture *
5 See also * 6 Notes * 7 References * 8 Further reading * 9 External links[edit] Social engineering techniques and termsAll social engineering techniques are based on flaws in human logic known as cognitive biases.

[2] These bias flaws are used in various combinations to create attack techniques, some of which are listed here:[edit] Pretexting.
Pretexting is the act of creating and using an invented scenario (the pretext) to persuade a target to release information or perform an action and is typically done over the telephone. It's more than a simple lie as it most often involves some prior research or set up and the use of pieces of known information (e.g., for impersonation: date of birth, Social Security Number, last bill amount) to establish legitimacy in the mind of the target.This technique is often used to trick a business into disclosing customer information, and is used by private investigators to obtain telephone records, utility records, banking records and other information directly from junior company service representatives. The information can then be used to establish even greater legitimacy under tougher questioning with a manager (e.g., to make account changes, get specific balances, etc).

As most U.S. companies still authenticate a client by asking only for a Social Security Number, date of birth, or mother's maiden name, the method is effective in many situations and will likely continue to be a security problem in the future.

Pretexting can also be used to impersonate co-workers, police, bank, tax authorities or insurance investigators — or any other individual who could have perceived authority or right-to-know in the mind of the target. The pretexter must simply prepare answers to questions that might be asked by the target. In some cases all that is needed is a voice of the right gender, an earnest tone and an ability to think on one's feet.Voice over IP programs are starting to become a standard in pretexting, as the absence of a traceable number makes the pretexter less vulnerable to being caught.[citation needed][edit]

Phishing Main article: PhishingPhishing is a technique of fraudulently obtaining private information. Typically, the phisher sends an email that appears to come from a legitimate business — a bank, or credit card company — requesting "verification" of information and warning of some dire consequence if it is not done. The letter usually contains a link to a fraudulent web page that looks legitimate — with company logos and content — and has a form requesting everything from a home address to an ATM card's PIN.[edit] IVR/phone phishingThis technique uses a rogue Interactive voice response (IVR) system to recreate a legitimate sounding copy of a bank or other institution's IVR system. The victim is prompted (typically via a phishing email) to call in to the "bank" (via a provided toll free number) and verify information. A typical system will continually reject logins ensuring the victim enters PINs or passwords multiple times. More advanced systems will even transfer the victim to the attacker posing as a customer service agent for further questioning.[edit] Trojan horse/gimmes Main article: Trojan horse (computing)Gimmes take advantage of curiosity or greed to deliver malware. Also known as a Trojan Horse, gimmes can arrive as an email attachment promising anything from a "cool" or "sexy" screen saver, an important anti-virus or system upgrade, or even the latest dirt on an employee. The recipient is expected to give in to the need to see the program and open the attachment. In addition, many users will blindly click on any attachments they receive that seem even mildly legitimate.[edit] Road appleA road apple is a real-world variation of a Trojan Horse that uses physical media and relies on the curiosity of the victim. The attacker leaves a malware infected floppy disc, CD ROM or USB flash drive in a location sure to be found (bathroom, elevator, sidewalk), gives it a legitimate looking and curiosity piquing label, and simply waits.For example: An attacker might create a disk featuring a corporate logo, readily available off the target's web site, and write "Executive Salary Summary Q1 2007" on the front. The attacker would then leave the disk on the floor of an elevator or somewhere in the lobby of the target company.An unknowing employee might find it and subsequently insert the disk into a computer to satisfy their curiosity, or a good samaritan might find it and turn it in to the company.In either case as a consequence of merely inserting the disk to see the contents, the user would unknowingly install malware on their computer, likely giving an attacker unfettered access to the target company's internal computer network.This method often uses "Autorun" systems so the user's computer is compromised the second the media is inserted.Note that the term 'Road Apple' has been re purposed from an older use meaning horse manure.[edit] Quid pro quoSomething for something: * An attacker calls random numbers at a company claiming to be calling back from technical support. Eventually they will hit someone with a legitimate problem, grateful that someone is calling back to help them. The attacker will "help" solve the problem and in the process have the user type commands that give the attacker access and/or launch malware. * In a 2003 information security survey, 90% of office workers outside of their building gave away what they claimed was their password in answer to a survey question in exchange for a cheap pen [1].[edit] Notable social engineers[edit] Kevin MitnickReformed computer criminal and security consultant Kevin Mitnick popularized the term, and points out that it's much easier to trick someone into giving you his or her password for a system than to spend the effort to hack in.[1] He claims it to be the single most effective method in his arsenal.[edit] OthersOther social engineers include Frank Abagnale, David Bannon, Peter Foster and Steven Jay Russell. Others under the pretense of Social Engineers include common confidence tricksters who have no real computer hacking expertise.[edit] United States law[edit] Pretexting of phone recordsIn December 2006, United States Congress approved a Senate sponsored bill making the pretexting of telephone records a Federal Felony with fines of up to $250,000 and 10 years in prison for individuals (or fines of up to $500,000 for companies). It was signed by president George W. Bush on January 12, 2007.[3][edit] The Gramm-Leach-Bliley Act (GLBA)Signed into U.S. law in 1999 specifically addresses pretexting of banking records as an illegal act punishable under federal statutes. Under the common law, pretexting is an invasion of privacy tort of appropriation; see Restatement 2d of Torts § 652C.When a business entity such as a private investigator, SIU insurance investigator or an adjuster conducts any type of deception, it falls under the authority of the Federal Trade Commission (FTC). This federal agency has the obligation and authority to ensure that consumers are not subject to any unfair or deceptive business practices.US Federal Trade Commission Act, Section 5 of the FTCA states, in part: "Whenever the Commission shall have reason to believe that any such person, partnership, or corporation has been or is using any unfair method of competition or unfair or deceptive act or practice in or affecting commerce, and if it shall appear to the Commission that a proceeding by it in respect thereof would be to the interest of the public, it shall issue and serve upon such person, partnership, or corporation a complaint stating its charges in that respect...."The statute states that if you are securing any personal, non-public information from a financial institution or the consumer, the action is covered by the statute. It relates to the consumer's relationship with the financial institution. For example, the pretexter is using false pretenses to get from the consumer's bank the consumer's address, that would be covered. Or, if the pretexter is going to the consumer and getting the name of his or her bank through false pretenses, that would be covered. The determining principle is that it is only pretexting if the information is obtained through false pretenses.While the sale of cell phone records has gained significant media attention, and telecommunications records are the focus of the two bills currently before the United States Senate, many other types of private records are being bought and sold in the public market. Alongside many advertisements for cell phone records, wireline records and the records associated with calling cards are advertised. As individuals shift to VoIP telephones, it is safe to assume that those records will be offered for sale as well.It is currently legal to sell phone records, but illegal to obtain them.[4]U.S. Rep. Fred Upton {R-Kalamazoo, Michigan}, chairman of the Energy and Commerce Subcommittee on Telecommunications and the Internet, expressed concern over the easy access to personal cell phone records on the Internet during Wednesday's E&C Committee hearing on “Phone Records For Sale: Why Aren't Phone Records Safe From Pretexting?”Illinois became the first state to sue an online records broker when Attorney General Lisa Madigan sued 1st Source Information Specialists, Inc., on 20 January, a spokeswoman for Madigan's office said. The Florida-based company operates several Web sites that sell cell phone records, according to a copy of the suit.The attorneys general of Florida and Missouri quickly followed Madigan's lead, filing suit on 24 January and 30 January, respectively, against 1st Source Information Specialists and, in Missouri's case, one other records broker - First Data Solutions, Inc.Several wireless providers, including T-Mobile, Verizon and Cingular, filed earlier lawsuits against records brokers, with Cingular winning an injunction against First Data Solutions and 1st Source Information Specialists on January 13.US Senator Charles Schumer (D-New York) introduced legislation in February of 2006 aimed at curbing the practice. The Consumer Telephone Records Protection Act of 2006 would create felony criminal penalties for stealing and selling the records of mobile phone, landline, and Voice over Internet Protocol (VoIP) subscribers.Hewlett Packard's Former Chairman, Patricia Dunn, reported that the HP board hired a private investigation company to delve into who was responsible for leaks within the board. Dunn acknowledged that this company used the practice of pretexting to solicit the phone records of board members and journalists. Chairman Dunn later apologized for this act and offered to step down from the board if it was desired by board members.[5] Unlike Federal law, California law specifically forbids such pretexting, and this case is being investigated by the California Attorney General.[edit] Social engineering in popular culture * In the film Hackers, the protagonist used a form of social engineering, where the main character accessed a TV network's control system by phoning the security guard for a modem number, posing as an important executive. Although the film is not highly accurate, the particular method demonstrates the power of social engineering.[edit] See also * Phishing * Confidence trick * Dumpster diving * Certified Social Engineering Prevention Specialist (CSEPS) * Physical information security * Vishing[edit] Notes 1. ^ a b CSEPS Course Workbook, p. 4 2. ^ CSEPS Course Workbook, unit 3 3. ^ Congress outlaws pretexting, Eric Bangeman, 12/11/2006 11:01:01, Ars Technica 4. ^ "Art of Deception", p. 103 5. ^ HP chairman: Use of pretexting 'embarrassing' Stephen Shankland, 2006-09-08 1:08 PM PDT CNET News.com[edit] References * John Leyden. April 18, 2003. Office workers give away passwords for a cheap pen. The Register. Retrieved 2004-09-09. * SirRoss. January 20, 2005. A Guide to Social Engineering, Volume 1 A Guide to Social Engineering, Volume 2. Astalavista. * Kevin Mitnick, Alexis Kasperavičius. 2004. "CSEPS Course Workbook." Mitnick Security Publishing. * Kevin Mitnick, William L. Simon, Steve Wozniak. 2002. "The Art of Deception: Controlling the Human Element of Security". John Wiley & Sons. ISBN 0-471-23712-4.[edit] Further reading * Boyington, Gregory. Baa Baa Black Sheep (Bantam Books, 1990) ISBN 0-553-26350-1[edit] External links * Social Engineering Fundamentals * Social Engineering, the USB Way - Dark Reading (7 June 2006) * Should Social Engineering be a part of Penetration Testing? Darknet * Federal Trade Commission on Pretexting * "Protecting Consumers' Phone Records" - US Committee on Commerce, Science, and Transportation - February 8, 2006 * Kaplan, David A.. "Intrigue in High Places", Newsweek, 2006-09-06. Retrieved on 2006-09-06. * Plotkin, Hal. "Memo to the Press: Pretexting is Already Illegal", What I Really Want to Say, 2006-09-08. Retrieved on 2006-09-13. * Abercrombie, Paul. "Risky Business", [2], 2006-07-01. Retrieved on 2007-03-01.